Described below is a method and a proxy server for the provision of a mobility key for cryptographic securing of mobility signaling messages for a home agent of a mobile network.
Internet with TCP/IP protocol offers a platform for the development of higher protocols for the mobile sector. As the internet protocols are widespread, a large circle of users can be reached with corresponding protocol extensions for mobile environments. The internet protocols were, however, not originally conceived for mobile use. In conventional internet packet switching, the packets are exchanged between stationary computers which neither change their network addresses nor move between different subnets. In radio networks with mobile computers, mobile computers MS are often integrated into different networks. The DHCP (Dynamic Host Configuration Protocol) enables dynamic allocation of an IP address and further configuration parameters to a computer in a network with the help of a corresponding server. A computer which is integrated into a network automatically receives a free IP address through the DHCP protocol. If a mobile computer has DHCP installed then it simply has to come into the range of a local network which supports the configuration over the DHCP protocol. Dynamic address allocation is possible in the DHCP protocol, i.e. a free IP address is automatically allocated for a specific time. After this time has finished, the request from the mobile computer must either be refreshed or the IP address can be otherwise assigned.
With DHCP, a mobile computer can be integrated into a network without manual configuration. The only requirement is that a DHCP server be available. In this way a mobile computer can use local network services and, for example, use files stored centrally. However, if a mobile computer offers services itself, then a potential service user cannot locate the mobile computer, as the IP address of this computer is changed in every network into which the mobile computer is integrated. The same thing happens whenever an IP address changes during an existing TCP connection. This leads to an interruption in the connection. For this reason, in mobile IP a mobile computer is allocated an IP address which it still retains in another network. In conventional IP network switching it is necessary to adapt the IP address settings correspondingly. A constant adaptation of IP and routing configurations to the end device is, however, almost impossible. In the conventional automatic configuration mechanisms, the existing connection is interrupted upon a change to the IP addresses. The mobile Internet protocol (MIP) protocol (RFC 2002, RFC 2977, RFC3344, RFC3846, RFC3957, RFC3775, RFC3776, RFC4285) supports the mobility of mobile end devices. In the conventional IP protocols, the mobile end device has to adapt its IP address every time it changes IP subnet, in order that the data packets addressed to the mobile end device are correctly routed. In order to hold up an existing TCP connection, the mobile end device has to retain its IP address, as a change of address leads to interruption of the connection. The MIP protocol removes this conflict in that it allows a mobile end device or a mobile node (MN) to have two IP addresses. The MIP protocol enables a transparent connection between the two addresses, namely a permanent home address and a second temporary care-of address. The care-of address is the IP address under which the mobile end device can currently be reached.
A home agent is a representative of the mobile end device as long as the mobile end device remains in the original home network. The home agent is constantly informed about the current whereabouts of the mobile computer. The home agent typically constitutes a component of a router on the home network of the mobile end device. Whenever the mobile end device is located outside the home network, the home agent provides a function such that the mobile end device can log on. Then, the home agent forwards the data packets addressed to the mobile end device into the current subnet of the mobile end device.
A foreign agent is located in the subnet in which the mobile end device moves. The foreign agent forwards incoming data packets on to the mobile end device, i.e. on to the mobile computer. The foreign agent is located in a so-called visited network. The foreign agent likewise typically represents a component of a router. The foreign agent routes all administrative mobile data packets between the mobile end device and its home agents. The foreign agent unpacks the IP data packets sent tunneled from the home agent, and forwards their data on to the mobile end device.
The home address of the mobile end device is the address at which the mobile end device can be permanently reached. The home address has the same address prefix as the home agent. The care-of address is the IP address which the IP end device uses in the foreign network.
The home agent administers a so-called mobility binding table (MBT). The entries in this table serve to allocate both addresses of a mobile end device, i.e. the home address and the care-of address, to each other, and to divert the data packets correspondingly. The MBT table contains entries about the home address, the care-of address and an entry about the span of time in which this allocation is valid (lifetime). FIG. 1 shows an example for a mobility binding table according to the related art.
The foreign agent (FA) contains a visitor list (VL) containing information about the mobile end devices which are currently located in the IP network of the foreign agent. FIG. 2 shows an example for such a visitor list according to the related art.
In order that a mobile computer can be integrated into the network, it must first learn whether it is located in its home or a visited network. In addition, the mobile end device must learn which computer in the subnet is the home or the foreign agent. These items of information are detected by so-called Agent Discovery.
The mobile end device can inform its home agents of its current location through the subsequent registration. To this end the mobile computer or the mobile end device sends the current care-of address to the home agents. The mobile computer sends a registration request to the home agents for registration. The home agent (HA) records the care-of address in its list and answers with a registration reply. At this juncture, however, there is a security problem. As, in principle, every computer can send a registration request to a home agent, it would be easy to give a home agent the false impression that a computer had moved into another network. In this way a foreign computer could take on all the data packets of a mobile computer or mobile end device without a sender knowing anything about it. In order to prevent this, the mobile computer and the home agent have a common secret key at their disposal. Should a mobile computer return into its home network then it is deregistered with the home agents, as from now on the mobile computer can accept all data packets itself. A mobile network must feature the following security measures, among others. Information may only be made accessible to desired communication partners, i.e. undesired eavesdroppers may not have access to transmitted data. The mobile network must therefore have a confidentiality capacity. Alongside this, authenticity must be given. The authenticity allows a communication partner to establish without doubt whether a communication was actually established with a desired communication partner or whether a foreign party is impersonating a communication partner. Authentications can be carried out per message or per connection. If authentication is carried on the basis of connections, then the communication partner is identified only once at the start of a session. For the further course of the session, it is then assumed that the following messages continue to originate from the corresponding sender. Even if the identity of a communication partner is established, the situation can arise that this communication partner may not gain access to all resources, or is not allowed to use all services on the network. In this case, a corresponding authorization requires a previous authentication of the communication partner.
In mobile data networks, messages must travel long stretches over air interfaces and so can easily be obtained by potential attackers. Security aspects therefore play a special role in mobile and wireless data networks. Encryption techniques constitute an essential way of raising the security in data networks. By encryption it is possible to transmit data over insecure communication channels, for example over air interfaces, without unauthorized third parties gaining access to the data. For encryption, the data, i.e. the so-called clear text, are transformed into cipher-text with the help of an encryption algorithm. The encrypted text can be transported over the insecure data transmission channel and subsequently decrypted or deciphered.
WiMax (Worldwide Interoperability for Microwave Access) is being suggested as the new standard for a very promising wireless access technology, which is used for the radio transmission IEEE 802.16. With WiMax, an area of up to 50 km should be supplied with over 100 Mbit per second by transmitting stations.
FIG. 3 shows a reference model for a WiMax radio network. A mobile end device MS is located in the region of an access network (ASN: Access Serving Network). The access network ASN is connected to a home network HCSN (Home Connectivity Service Network) by at least one visited network (Visited Connectivity Service Network VCSN). The various networks are connected with each other by interfaces or reference points R. The home agent HA of the mobile station MS is located in the home network HCSN or in one of the visited networks VCSN.
WiMax supports two implementation variants of mobile IP, so-called client MIP (CMIP), in which the mobile station itself implements the MIP client function, and proxy MIP (PMIP), in which the MIP client function is implemented by the WiMax access network. The functionality intended for this in the ASN is labeled proxy mobile node (PMN) or PMIP client. MIP can thereby be used with mobile stations which themselves do not support an MIP.
FIG. 4 shows the connection establishment in proxy MIP whenever the home agent is located in the visited network according to the related art.
After construction of a radio link between the mobile end device and a base station, there first takes place an access authentication. The functioning of the authentication, the authorization and the bookkeeping is carried out by so-called AAA servers (AAA: Authentication, Authorization and Accounting). Authentication messages are exchanged between the mobile end device MS and the AAA server of the home network (HAAA), by which the address of the home agents and an authentication key are obtained. The authentication server in the home network contains the profile data of the subscribers. The AAA server obtains an authentication request message, which contains a subscriber's identity of the mobile end device. After successful access authentication, the AAA sever generates an MSK key (MSK: Master Session Key) to protect the data transmission lines between the mobile end device MS and the base stations of the access network ASN. This MSK key is transmitted by the AAA server of the home network over the intermediate network CSN to the access network ASN.
After the access authentication the DHCP proxy server in the access network ASN is configured, as can be seen in FIG. 4. Should the IP address and host configuration already be contained in the AAA answer message, then the total information is downloaded into the DHCP proxy server.
After successful authentication and authorization, the mobile station or the mobile end device MS sends a DHCP discovery message and an IP address allocation is carried out.
Should the access network ASN support both PMIP and CMIP mobility, then the foreign agent informs the ASN handover function in that it sends a R3 mobility context message. There is dispensed with in networks which only support PMIP. After the home address has been read out, this is forwarded on to the PMIP client.
Subsequently an MIP registration takes place. In the registration, the home agent is informed about the current location of the mobile end device. For registration, the mobile computer sends the registration request to the home agent which contains the current care-of address. The home agent carries the care-of address in a list managed by it and answers with a registration reply. As, in principle, every computer can send registration requests to a home agent, a home agent could easily be made to believe that a computer had moved into another network. In order to prevent this, both the mobile computer and the home agent have access to a common secret key, namely an MIP key. Should the home agent (HA) not know the MIP key, it sets it up, for which it communicates with a home AAA server.
After completion of the connection establishment depicted in FIG. 4, the mobile end device has obtained a home address and is registered with the home agents.
The connection establishment depicted in FIG. 4 is impossible, though, if the home AAA server does not deliver the attributes or data expected by the WiMax protocol. If this concerns a home AAA server which is a 3GPP server or some other AAA server which does not support WiMax interworking, then it is not in a position to provide the data attributes necessary for the MIP registration, in particular the home address and a cryptographic key. So the home agent HA obtains no MIP key (MSK: Master Session Key) and rejects the subscriber.